[New Idea] Bypass Safetynet by without having to depend on MAGISK

[HuskyDG]

Maybe you didn't know, most banking apps prefer to detect Riru or Zygisk. No matter we try to hide it, or use closed source module like Shamiko, Zygisk will be detected again time by time. Most users enable Zygisk just to install Safetynet Fix, but that will cause dirty in environment and apps will detect it.

Not all banking apps rely on SafetyNet for root detection, they bought detection from such big security like Appdome, DexGuard, DexProtector, ...

When Zygisk is disabled, you can use almost of banking apps, but cannot use some apps like GPay, Netflix,...

The only way is to use Custom ROMs that can pass Safetynet by default, for those people who use device with no Custom ROM available, there is no choice.

How to inject code into Safetynet without Riru/Zygisk? Although the implementation of Riru and Zygisk is different, they both inject into Zygote and unload after fork, however, dirty traces is still obviously. Ptrace allows modify memory and inject code, for who we do not ptrace, there will be nearly no traces at all. We can use it to attach gms and then inject Safetynet Fix code. I don't have much knowledge about ptrace() so I still can't implement it by myself I think it will work also without Magisk, and it can even be portable for any ROMs (atleast without having to rebuild ROMs)

Last, I think safetynet fix should not rely on Magisk.

[HuskyDG]

About hiding Magisk without Zygisk, I have build a simple module here (using ptrace) for official Magisk: https://github.com/huskydg/magiskhide

I also have a Magisk fork to restore MagiskHide.

[crypticc1]

Thank you. To clarify in case important with this MagiskHide it does hide Magisk but doesn't pass PI or SN. The suggestion above I think is a module like USNF, but using ptrace like this MagiskHide, so that USNF can be run without Zygisk. Is that possible?

[HuskyDG]

This need a lot of works

[HuskyDG]

@kdrag0n Consider SafetyNet Fix should not be rely on Magisk and many people don't want to install Magisk so this is the only way. If you don't have plans yet, just make this as placeholder for future needs

[HuskyDG]

With selinux, you can block gms from using keystore:

deny gmscore_app keystore keystore_key *

Safetynet sensitive props

Manyone tested and it worked. But I think it should be a better solution

[HuskyDG]

oops, i close accidentally

[matogilak]

So when flashing sensitive props and your magiskhide fork i dont need universal safetynet fix by kdragon?

[crypticc1]

No, two different things. Just placed here as example of using ptrace. Suggest asking here at OP... https://forum.xda-developers.com/t/discussion-magisk-delta-another-unofficial-third-party-magisk-fork.4460555/post-88155321

[VisionR1]

With selinux, you can block gms from using keystore:

deny gmscore_app keystore keystore_key *

Safetynet sensitive props

Manyone tested and it worked. But I think it should be a better solution

@HuskyDG. I have Xiaomi Poco X3 NFC android 10 with magisk 23 with enable magiskhide, I try your module sensitive_props-v3.zip but not working, CTS profile match is failed and the Google play store say device is not certified

[grigotierpascal]

Hey Hamood111, can you contact me on TG or email grigotierpascal@gmail.com , i need you please for a job